CVE intelligence

CVE-2026-18329

Vulnerability intelligence

Published Sep 2, 2026Sources checked Oct 28, 2026

8.2HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-18329 and is rated High severity with a CVSS score of 8.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Sep 20, 2026

See the Microsoft Security Update Guide for the update that applies to your product.

Vendor-listed releases

1.30.4-1

CISA KEVNot listedBased on the latest collected catalog

EPSS0.6%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-18329?

Description

NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic.

This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.

Impact

This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Source: NVD